CVE-2026-99121

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_routes_with_linkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero. If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6_multipath_rebalance") and preserves the lock-free rebalance path.

Is your site exposed to CVE-2026-99121?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0019

Probability of exploitation

0.08%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0800c92ca5d1983df6843a5435299978901d1d02 https://git.kernel.org/stable/c/226a974054acbd892560bfa67f0ae8ffe271a736 https://git.kernel.org/stable/c/5046d2880fec7d49ebed2fd2866747ee1d06ad71 https://git.kernel.org/stable/c/5dac5c7ba8f5f3fb4bf29f2a2c3cb552f5b83c8f https://git.kernel.org/stable/c/7c68f4de5090b17b63b9a0a3b01b3807e01a296a https://git.kernel.org/stable/c/baf3a767b2845eb8e68f056ee4aa5b41b151e990 https://git.kernel.org/stable/c/d5520e815c4b1427104ce1428ee23821f2aa824d https://git.kernel.org/stable/c/f655a26490e705ec76a79db7f412847fda342b39

Frequently Asked Questions

What is CVE-2026-99121? +

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_routes_with_linkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero. If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6_multipath_rebalance") and preserves the lock-free rebalance path.

How do I check if I'm vulnerable to CVE-2026-99121? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.